Maximizing the Benefits of Intrusion Prevention Systems: Effective Deployments Strategies Charles Iheagwara, Farrukh Awan, Yusuf Acar, Calvin Miller Office of the Chief Technology, District of Columbia Government Washington DC 18 th Annual FIRST Conference Baltimore Maryland June 25 – 30, 2006
Introduction Six basic drawbacks of current IDS products that limit its effectiveness as a security solution [1]: • Performance Barriers • Detection Accuracy • Product Complexity • Growing IDS Evasion • Passive Device • Enterprise Scalability • The drawbacks were put squally in front of the burner when research firm Gartner Inc. provided another nudge when it declared IDS will be obsolete by 2005 [2]. The report accelerated the call by some industry analysts to kiss a final goodbye to the IDS as an essential security technology. And since then, the death knell for intrusion detection has been getting louder.
Introduction Cont. Gartner provides three reasons for this: • “99 out of 100” alerts mean nothing • Plethora of false positives • Voluminous amounts of data "The underlying problem with IDS is that enterprises are investing in technology to detect intrusions on a network. This implies they are doing something wrong and letting those attacks in," said Gartner vice president of research Richard Stiennon [3].
Industry Reaction • In the aftermath of Gartner’s assertions, many industry analysts have risen to the defense of IDSes; and calls for improvement of existing technologies. For example, Andre Yee, NFR Security [4] writes: • “The Silver Bullet Syndrome… In view of these perceived limitations, some industry pundits are writing off IDSs altogether in favor of newer network intrusion prevention systems (NIPS). However well intended, casting NIPS technology as a remedy to all that ails the IDS is an unfortunate oversimplification. There are three reasons for this. First, as noted in the prior section, many of the issues regarding current generation IDS products are unrelated to the issue of "prevention versus detection". For example, the distinct challenge of scaling IDS from a point product to an enterprise solution have more to do with good design than with the benefits of prevention over detection. A poorly designed NIPS product will undoubtedly encounter similar scalability problems as a poorly designed IDS product…”
Industry Reaction Cont. • Thus, the prevailing concerns about IDS provides the need and is an impetus for a new kind of network intrusion management product that comprehensively addresses the limitations of current products while delivering better detection, enterprise manageability, and prevention. • In the last two years, there has been some noticeable progress in the development of intrusion prevention systems (IPS). Some of the developments are in the beta testing stage and others have made their debut in the IPS in the market place. • Against this background, this paper presents the business and technical imperatives of the IPS and reviews IPS concepts and implementation, analyzes performance factors and proposes effective deployment strategies.
Industry Reaction Cont. • Thus, the prevailing concerns about IDS provided the need and impetus for a new kind of network intrusion management product that comprehensively addresses the limitations of current products while delivering better detection, enterprise manageability, and prevention. • There were other techno-economic imperatives
Techno-Economic Imperatives of Introducing IPS to the Market Place • Three basic premises define the needs: • Mission critical applications and systems must be available – What are my mission critical applications and systems? – Which critical assets are at risk? Under attack? • Regulatory compliance and risk mitigation are a modern business reality – Are we compliant with rules and regulations? – We’ve invested all this money – how secure are we? • Resources are constrained – Turn-key, real-time, 24*7 security infrastructure. – Cost-effectiveness is paramount.
Techno-Economic Imperatives of Introducing IPS to the Market Place: Figure 1: Resource Gap 120% 115% 110% 105% 100% 95% 90% 1998 1999 2000 2001 2002 Vulnerabilities Staffing
Gartner's Recommendations: A Precursor to IPS Introduction • Gartner recommended “Real-time Network Defense.” • … intrusion prevention systems to support rapid shielding • ABC’s of Defense – Alert, Block, or Correct • In the last few years, several commercial intrusion prevention systems (IPS) made their debut in the IPS in the market place.
Definition • Intrusion Prevention is the act of dropping detected bad traffic in real-time by not allowing the traffic to continue to its destination, and is useful against denial of services floods, brute force attacks, vulnerability detection, protocols anomaly detection and prevention against ‘Zero day” (unknown) exploits. • A basic distinction is that the IDS is an out of band technology whereas the IPS sits in-line on the network. In this case, the IPS monitors the network much like the IDS but when an event occurs, it takes action based on prescribed rules. Security administrators can tweak such rules so the systems respond in the way they would.
Intrusion Prevention Approaches • "Intrusion prevention" can be achieved through three main approaches: Secure engineering - building systems with no vulnerability, Taking perfect remediation steps to uncover vulnerabilities and patch them, and detecting the exploit attempts and blocking them before serious damage is done.
In-line Mode Vs. Out of Band Concepts • As stated before, the IPS operates on the In-line mode i.e. the sensor is placed directly in the network traffic path, inspecting all traffic at wire speed as it passes through the assigned port pair. In-line mode enables the sensor to run in a protection/prevention mode, where packet inspection is performed in real time, and intrusive packets are dealt with immediately – the sensor can drop malicious packets (defined though policy) because it is physically in the path of all network traffic. This enables it to actually prevent an attack reaching its target. • Thus, given the mission defined for it and in contrast to the IDS, the IPS mode of operation enables it to provide preemptive protection.
IPS Performance Metrics • Given the functional requirement for the IPS, the performance metrics should be measured in terms of: • The IPS’s dynamic alerting capability, • The IPS’s dynamic blocking capability, or • The IPS’s ability to correctly identify attacks. • The IPS’s ability to identify if a system’s patch level makes it susceptible to impending attacks, • The IPS’s Accuracy of dropping packets • The number of false positives • The IPS’s Fail open and fail safe capability • The IPS’s High availability and redundancy architecture
Effectiveness Measures • The decision to invest on the IPS hinges on the ability to demonstrate a positive ROI. In essence, this entails quantifying the IPS's value prior to deploying it. • Therefore, the effectiveness of the IPS will be tied to a positive ROI value.
IPS Deployment Strategies • Generally, there are several product configurable and network/system parametric variables that affect the performance effectiveness of the IPS: • High Bandwidth Throughput • Minimum Packet Latency • Accuracy of Detection • Accuracy of Dropping Packets • Ability to detect unknown attacks (Protocol Anomaly) • Few false Positives • Policy based Controls • Fail Open and Fail Safe Capability • High Availability and Redundancy Architecture
Area of coverage • To maximize the benefits of the IPS, it must be deployed in a way that positions the traffic streams to transverse through it for a wider scope of visibility such that it can perform a deep inspection of the packets and based on the pre-defined rules take appropriate actions i.e. allowing passage of the packets, sending an RST, dropping packets, etc. • Based on previous studies [10] and data from our field practice [AWAN], we propose the following deployment location to maximize the IPS effectiveness: • Deployment where high security and protection is required • Deployment at the defense perimeter • Deployment where there is a high probability of an internal outbreak and attack; and • Deployment through strategic segmentation of the network into smaller areas for better distributed architecture
Recommend
More recommend
